CVE-2026-80897: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80897 is a resource leak vulnerability in the Linux kernel's netfs (network filesystem) subsystem that can lead to a denial of service. The flaw exists in netfs_prepare_read_iterator(), which fails to release batched readahead folio references when rolling_buffer_load_from_ra() encounters an error mid-operation. Affected kernel versions begin at commit 06fa229ceb36898e68022b5654c017d2c6582d7d (introduced in Linux 6.14) and are fixed in stable releases 6.18.44, 7.1.8, and 7.2. The vulnerability was published on September 4, 2026, with an estimated CVSS severity of Medium and an EPSS score of approximately 0.166% (GitHub Advisory, Feedly).

The root cause is a missing cleanup path (CWE category: resource leak / improper resource release) in the netfs_prepare_read_iterator() function within the Linux kernel's netfs subsystem. When rolling_buffer_load_from_ra() fails after some readahead folios have already been batched into put_batch, the function returns the error immediately without calling the batch release routine, leaving folio references permanently held. The fix ensures the folio batch is explicitly released before propagating the error, preventing the reference leak. No public proof-of-concept exploit code is known to exist (GitHub Advisory, Feedly).

A local user with the ability to trigger readahead operations in the netfs subsystem can repeatedly cause iterator preparation failures, exhausting kernel memory through accumulated unreleased folio references. The primary impact is a denial of service — the affected system may become unresponsive or crash due to kernel memory exhaustion. There is no evidence of confidentiality or integrity impact; lateral movement and data exfiltration are not associated with this vulnerability (Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the publication date. The vulnerability requires local access to trigger readahead operations in the netfs subsystem, limiting its attack surface. The EPSS score is approximately 0.166% (6th percentile), indicating a low probability of exploitation in the near term. CVE-2026-80897 is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory, Feedly).

Apply the kernel patches that introduce the folio batch release fix before returning errors from netfs_prepare_read_iterator(). Fixed versions are available in stable branches: commit 2c148a31ca01fc160aceec777bbc0041b0d0b8bd (one stable branch), 935e7b74bb2368f215cf8c2ad4bff60ee4e7589e (second stable branch), and 87eb3d272dcbcbbfe5c1576c10e5dc72810cf1f6 (third stable branch), corresponding to kernel releases 6.18.44, 7.1.8, and 7.2. As a temporary workaround where immediate patching is not feasible, consider restricting local user access to operations that trigger netfs readahead, and monitor system memory usage for signs of folio reference leaks (GitHub Advisory, Feedly).